Fenasbac and GASA Report Outlines a Cross-Sector Response to Digital Scams in Brazil

Brazil’s rapid adoption of Pix, Open Finance and mobile banking has made financial services faster and more accessible. It has also created an environment in which scams can move from initial contact to payment within seconds, often crossing several platforms and institutions before the loss becomes visible.

Brazilians are estimated to lose R$99 billion to digital scams annually and face an average of 252 scam attempts per person each year. Yet the organisations capable of detecting and disrupting these crimes often see only one part of the journey.

Fenasbac and the Global Anti-Scam Alliance (GASA) examine how to close these gaps in The Impact of Digital Scams on the Brazilian Financial System – The Brazil Blueprint. Drawing on contributions from Banco Central do Brasil, FEBRABAN, GSMA, Mercado Bitcoin and Amazon Web Services (AWS), the report sets out how regulation, technology and cross-sector intelligence can support a more resilient financial system.

Innovation Has Expanded the Attack Surface

Brazil is a global reference point for digital financial innovation. The country processes 240.8 billion banking transactions, with 69% taking place through digital channels and mobile devices accounting for 78% of those transactions. Pix has widened financial participation and made instant payments part of everyday life.

The report describes the corresponding increase in risk as the “innovation attack surface”. Stronger protection of core banking infrastructure has encouraged criminals to focus more heavily on customers, using social engineering, impersonation, fraudulent advertisements, phishing and fake customer service channels to induce authorised payments or obtain access to accounts.

This does not make innovation itself the cause of scams. It means safeguards need to match the speed, scale and interconnected nature of the systems being introduced. FEBRABAN’s contribution describes a continuous security architecture in which monitoring, threat detection and cyber controls evolve alongside new products rather than being added after deployment.

The banking sector invests approximately R$50 billion in technology each year, with around 10% directed to cybersecurity. However, investment within financial institutions can address only part of the problem when the initial contact may happen through a telephone call, message, online advertisement, marketplace or social media account.

Following the Full Scam Chain

The report’s Scam Cycle illustrates how digital scams develop across three broad stages: initial contact, manipulation and trust, then monetisation. A criminal may first reach a potential victim through a spoofed call or fraudulent profile, build credibility through sustained interaction and then direct a payment through an instant transfer, card, crypto asset or money mule account.

Each stage produces different warning signals. Telecommunications providers can identify unusual activity associated with a mobile number or device. Digital platforms can detect fraudulent advertisements, accounts and content. Financial institutions can monitor changes in payment behaviour, while crypto asset providers can trace on-chain movements and connect pseudonymous wallets to known customers. Law enforcement and regulators hold further information on reports, investigations and repeat offenders.

These signals are far less useful when they remain isolated. By the time one organisation identifies a suspicious transaction, the funds may already have moved through several accounts, providers or jurisdictions. The report therefore argues that prevention should begin before the payment stage and continue through reporting, asset recovery, disruption of money laundering and protection against repeat victimisation.

Five Principles for a More Resilient System

The Brazil Blueprint identifies five principles for building protection that can operate at the speed of the digital economy:

Turning the Blueprint Into Practice

An accompanying Portuguese-language webinar examines how the Blueprint’s principles can be applied in practice. Speakers include:

• Fabrício Tota, Mercado Bitcoin
• Raphael Mielle, FEBRABAN
• Ulysses Pacheco, AWS
• Renata Salvini, GASA
• Rodrigoh Henriques, Fenasbac

The discussion shows that collaboration needs to extend beyond general commitments and connect the operational capabilities of different sectors.

For financial institutions, this includes security by design, shared technical standards and coordination with regulators and other institutions. Mielle explains that fraud prevention is not a competitive advantage for one bank over another: weaknesses in one part of the ecosystem can create risks for the wider system. Henriques similarly points to the need for baseline protections that prevent smaller institutions or new market entrants from becoming easier routes into the financial system.

Tota explains how blockchain records can support investigations because transactions remain public, permanent and traceable. On-chain visibility alone does not identify the person controlling a wallet, however. Crypto asset providers play an important role by connecting pseudonymous activity to verified customers, monitoring transactions and sharing relevant intelligence with authorities and other institutions.

Salvini explains that scams often begin through telephone calls, social media, text messages or emails before reaching the financial system. Because each sector sees only part of this journey, she argues that financial institutions, telecommunications providers, technology companies, governments and law enforcement must share intelligence and build multiple layers of protection. She also stresses that anyone can be manipulated by a scam and that consumers cannot be expected to become fraud specialists, placing greater responsibility on organisations with the data, expertise and ability to intervene.

The report provides a practical example of this coordination through telecommunications data. GSMA Open Gateway APIs such as Number Verify and SIM Swap can enable financial institutions to check for signs that a customer’s mobile line has been compromised before authorising a payment. This combines signals held by mobile operators with the decision-making controls available to banks.

Pacheco considers how federated data infrastructure and specialised AI systems could connect intelligence across institutions without requiring one organisation to hold all the underlying data. Participating institutions would retain control of their data while contributing governed analytical signals to a shared environment. Composite risk indicators could then support trained human reviewers rather than triggering automatic sanctions based on a single data point.

What This Demonstrates

Brazil’s experience shows that advanced financial infrastructure and effective scam prevention need to develop together. The objective is not to slow digital payments, financial inclusion or technological innovation, but to ensure that protection is built into the same systems from the outset.

The Brazil Blueprint also shows why responsibility cannot sit only with the institution processing the final payment. Scams exploit gaps between sectors, data sources and jurisdictions. Closing those gaps requires clear responsibilities, proportionate regulation, interoperable intelligence and mechanisms that allow organisations to act before a suspicious interaction becomes a financial loss.

Brazil already has the financial infrastructure, regulatory experience and technology ecosystem needed to test this model at scale. Its wider value will depend on whether those capabilities can be connected around a shared objective: identifying and disrupting scams across the full chain while strengthening support for the people targeted.

Sign up for the GASA newsletter to receive regular updates on scam prevention, research, and best practices.